On Wed, 2013-11-06 at 22:13 +0200, Michael S. Tsirkin wrote:
> On Wed, Nov 06, 2013 at 09:54:03PM +0200, Marcel Apfelbaum wrote:
> > On Wed, 2013-11-06 at 20:47 +0200, Michael S. Tsirkin wrote:
> > > A bug reported by Luiz Capitulino let us to find
> > > several bugs in memory address space setup.
> > >
> > > One issue is that gdb stub can give us arbitrary addresses
> > > and we'll try to access them.
> > > Since our lookup ignored high bits in the address,
> > > we hit a wrong section and got a crash.
> > > In fact, PCI devices can access arbitrary addresses too,
> > > so we should just make lookup robust against this case.
> > >
> > > Another issue has to do with size of regions.
> > > memory API uses UINT64_MAX so say "all 64 bit" but
> > > some devices mistakenly used INT64_MAX.
> > >
> > > It should not affect most systems in practice as
> > > everything should be limited by address space size,
> > > but it's an API misuse that we should not keep around,
> > > and it will become a problem if a system with 64 bit
> > > target address hits this path.
> > >
> > > Patch 1 fixes an actual bug.
> > > The rest of patches make code cleaner and more robust.
> > >
> > > Michael S. Tsirkin (4):
> > > exec: don't ignore high address bits on lookup
> > > pci: fix address space size for bridge
> > > exec: don't ignore high address bits on set
> > > spapr_pci: s/INT64_MAX/UINT64_MAX/
> > >
> > > Paolo Bonzini (1):
> > > pc: s/INT64_MAX/UINT64_MAX/
> > >
> > > exec.c | 9 +++++++++
> > > hw/i386/pc_piix.c | 2 +-
> > > hw/i386/pc_q35.c | 2 +-
> > > hw/pci/pci_bridge.c | 2 +-
> > > hw/ppc/spapr_pci.c | 2 +-
> > > 5 files changed, 13 insertions(+), 4 deletions(-)
> > >
> >
> > Reviewed-by: Marcel Apfelbaum <marce...@redhat.com>
> >
>
> Please don't apply this.
>
> I didn't post the patches - I only sent them to Marcel :)
> And the reason is that the assert in exec. detects more bugs with
> over-writing page-tables: just run make check.
>
> I think we need to get a handle on them first before applying.
>
Found the issues with make check, so that this series can be posted.
I'll send a proper patch tomorrow:
diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c
index 59e1bb8..c203935 100644
--- a/hw/alpha/typhoon.c
+++ b/hw/alpha/typhoon.c
@@ -888,7 +888,8 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
/* Host memory as seen from the PCI side, via the IOMMU. */
memory_region_init_iommu(&s->pchip.iommu, OBJECT(s), &typhoon_iommu_ops,
- "iommu-typhoon", UINT64_MAX);
+ "iommu-typhoon", TARGET_PHYS_ADDR_SPACE_BITS ==
64 ?
+ UINT64_MAX : (0x1ULL <<
TARGET_PHYS_ADDR_SPACE_BITS));
address_space_init(&s->pchip.iommu_as, &s->pchip.iommu, "pchip0-pci");
pci_setup_iommu(b, typhoon_pci_dma_iommu, s);
diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
index ef45f4f..84b1309 100644
--- a/hw/ppc/spapr_iommu.c
+++ b/hw/ppc/spapr_iommu.c
@@ -136,7 +136,9 @@ static int spapr_tce_table_realize(DeviceState *dev)
trace_spapr_iommu_new_table(tcet->liobn, tcet, tcet->table, tcet->fd);
memory_region_init_iommu(&tcet->iommu, OBJECT(dev), &spapr_iommu_ops,
- "iommu-spapr", UINT64_MAX);
+ "iommu-spapr",
+ TARGET_PHYS_ADDR_SPACE_BITS == 64 ?
+ UINT64_MAX : (0x1ULL <<
TARGET_PHYS_ADDR_SPACE_BITS));
QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list);
Thanks,
Marcel
